@crewhaus/sandbox-image-go 0.1.4 → 0.1.6

package/dist/index.d.ts

@@ -0,0 +1,33 @@
+import { type SandboxImageEntry } from "@crewhaus/sandbox-image-registry";
+/**
+ * Catalog R8 `sandbox-image-go` — Section 36 polyglot Go sandbox image.
+ *
+ * Registers a curated Go 1.23 image into `@crewhaus/sandbox-image-registry`
+ * so polyglot agents can `lookupSandboxImage("go")` and route a snippet
+ * through `tool-code-execution`'s sandbox path.
+ *
+ * Snippet mode (default entrypoint): `go run -` reads stdin as a single
+ * `package main` source file. Advanced callers who mount a project can
+ * exec `./<binary>` after a build step — the entrypoint is overridable
+ * at `sandbox.exec({ argv })` time.
+ *
+ * Cold-start budget: ≤2s for the compiled-language warm pool; the
+ * `healthcheck.timeoutMs = 2_000` enforces the registry's view of
+ * "healthy". Live-image probe runs `go version` against the actual
+ * docker image when `CREWHAUS_SECTION36_LIVE_DOCKER=1` is set.
+ *
+ * Layer R8. Pairs with `sandbox-image-registry` (R8 — registration
+ * surface) and `sandbox` (R8 — exec backend).
+ */
+export declare const GO_IMAGE_ID = "go";
+export declare const GO_IMAGE_REF = "golang:1.23-alpine";
+export declare const GO_DEFAULT_ENTRYPOINT: ReadonlyArray<string>;
+export declare const GO_HEALTHCHECK_ARGV: ReadonlyArray<string>;
+/** Cold-start budget for the warm pool (ms). T7 layer asserts this. */
+export declare const GO_COLD_START_BUDGET_MS = 2000;
+/**
+ * Register the Go 1.23 image. Idempotent — calling twice throws via
+ * the registry's duplicate-id refusal. Callers in app boot paths
+ * should call `registerGoSandboxImage()` once.
+ */
+export declare function registerGoSandboxImage(): SandboxImageEntry;

package/{src/index.ts → dist/index.js}

@@ -1,5 +1,4 @@
-import { type SandboxImageEntry, registerSandboxImage } from "@crewhaus/sandbox-image-registry";
-
+import { registerSandboxImage } from "@crewhaus/sandbox-image-registry";
 /**
  * Catalog R8 `sandbox-image-go` — Section 36 polyglot Go sandbox image.
  *
@@ -20,31 +19,27 @@ import { type SandboxImageEntry, registerSandboxImage } from "@crewhaus/sandbox-
  * Layer R8. Pairs with `sandbox-image-registry` (R8 — registration
  * surface) and `sandbox` (R8 — exec backend).
  */
-
 export const GO_IMAGE_ID = "go";
 export const GO_IMAGE_REF = "golang:1.23-alpine";
-export const GO_DEFAULT_ENTRYPOINT: ReadonlyArray<string> = ["go", "run", "-"];
-export const GO_HEALTHCHECK_ARGV: ReadonlyArray<string> = ["go", "version"];
-
+export const GO_DEFAULT_ENTRYPOINT = ["go", "run", "-"];
+export const GO_HEALTHCHECK_ARGV = ["go", "version"];
 /** Cold-start budget for the warm pool (ms). T7 layer asserts this. */
 export const GO_COLD_START_BUDGET_MS = 2_000;
-
 /**
  * Register the Go 1.23 image. Idempotent — calling twice throws via
  * the registry's duplicate-id refusal. Callers in app boot paths
  * should call `registerGoSandboxImage()` once.
  */
-export function registerGoSandboxImage(): SandboxImageEntry {
-  return registerSandboxImage({
-    id: GO_IMAGE_ID,
-    image: GO_IMAGE_REF,
-    defaultEntrypoint: GO_DEFAULT_ENTRYPOINT,
-    healthcheck: {
-      command: GO_HEALTHCHECK_ARGV,
-      expectedExitCode: 0,
-      timeoutMs: GO_COLD_START_BUDGET_MS,
-    },
-    description:
-      "Go 1.23 alpine — snippet mode via `go run -`; compiled-binary mode for mounted projects.",
-  });
+export function registerGoSandboxImage() {
+    return registerSandboxImage({
+        id: GO_IMAGE_ID,
+        image: GO_IMAGE_REF,
+        defaultEntrypoint: GO_DEFAULT_ENTRYPOINT,
+        healthcheck: {
+            command: GO_HEALTHCHECK_ARGV,
+            expectedExitCode: 0,
+            timeoutMs: GO_COLD_START_BUDGET_MS,
+        },
+        description: "Go 1.23 alpine — snippet mode via `go run -`; compiled-binary mode for mounted projects.",
+    });
 }

package/package.json

@@ -1,20 +1,23 @@
 {
   "name": "@crewhaus/sandbox-image-go",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "type": "module",
   "description": "Go 1.23 polyglot sandbox image: registry registration + multi-stage Dockerfile + T2/T7/T8 contract tests (Section 36)",
-  "main": "src/index.ts",
-  "types": "src/index.ts",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
   "exports": {
-    ".": "./src/index.ts"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
   },
   "scripts": {
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/errors": "0.1.4",
-    "@crewhaus/sandbox": "0.1.4",
-    "@crewhaus/sandbox-image-registry": "0.1.4"
+    "@crewhaus/errors": "0.1.6",
+    "@crewhaus/sandbox": "0.1.6",
+    "@crewhaus/sandbox-image-registry": "0.1.6"
   },
   "license": "Apache-2.0",
   "author": {
@@ -34,5 +37,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "files": ["src", "README.md", "LICENSE", "NOTICE"]
+  "files": ["dist", "README.md", "LICENSE", "NOTICE"]
 }

package/src/index.test.ts

@@ -1,185 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { createSandbox } from "@crewhaus/sandbox";
-import {
-  ImageRegistrationError,
-  _resetSandboxImageRegistry,
-  hasSandboxImage,
-  listAllowedImageRefs,
-  lookupSandboxImage,
-  registerSandboxImage,
-} from "@crewhaus/sandbox-image-registry";
-import {
-  GO_COLD_START_BUDGET_MS,
-  GO_DEFAULT_ENTRYPOINT,
-  GO_HEALTHCHECK_ARGV,
-  GO_IMAGE_ID,
-  GO_IMAGE_REF,
-  registerGoSandboxImage,
-} from "./index";
-
-describe("registerGoSandboxImage (T1 + T2)", () => {
-  beforeEach(() => {
-    _resetSandboxImageRegistry();
-  });
-  afterEach(() => {
-    _resetSandboxImageRegistry();
-  });
-
-  test("constants match the kickoff prompt's spec", () => {
-    expect(GO_IMAGE_ID).toBe("go");
-    expect(GO_IMAGE_REF).toBe("golang:1.23-alpine");
-    expect(GO_DEFAULT_ENTRYPOINT).toEqual(["go", "run", "-"]);
-    expect(GO_HEALTHCHECK_ARGV).toEqual(["go", "version"]);
-  });
-
-  test("registerGoSandboxImage() registers an image with the right shape", () => {
-    const entry = registerGoSandboxImage();
-    expect(entry.id).toBe("go");
-    expect(entry.image).toBe("golang:1.23-alpine");
-    expect(entry.defaultEntrypoint).toEqual(["go", "run", "-"]);
-    expect(entry.healthcheck.command).toEqual(["go", "version"]);
-    expect(entry.healthcheck.expectedExitCode).toBe(0);
-    expect(entry.healthcheck.timeoutMs).toBe(GO_COLD_START_BUDGET_MS);
-    expect(entry.description).toMatch(/Go 1\.23/);
-  });
-
-  test("lookupSandboxImage('go') returns the registered entry", () => {
-    registerGoSandboxImage();
-    expect(hasSandboxImage("go")).toBe(true);
-    const entry = lookupSandboxImage("go");
-    expect(entry.image).toBe("golang:1.23-alpine");
-  });
-
-  test("listAllowedImageRefs includes golang:1.23-alpine after registration", () => {
-    registerGoSandboxImage();
-    const refs = listAllowedImageRefs();
-    expect(refs).toContain("golang:1.23-alpine");
-    // Bootstrap trio still present
-    expect(refs).toContain("python:3.13-slim");
-    expect(refs).toContain("node:22-alpine");
-  });
-});
-
-describe("Go-shape T2 contract — round-trip via noop sandbox", () => {
-  beforeEach(() => {
-    _resetSandboxImageRegistry();
-  });
-  afterEach(() => {
-    _resetSandboxImageRegistry();
-  });
-
-  test("noop sandbox accepts golang:1.23-alpine when registered", async () => {
-    registerGoSandboxImage();
-    const sandbox = createSandbox({
-      backend: "noop",
-      allowedImages: listAllowedImageRefs(),
-    });
-    // The noop backend spawns the argv directly — `printf` is universal,
-    // so we use it instead of `go run -` to assert the wiring without
-    // needing a Go toolchain on the test host.
-    const result = await sandbox.exec({
-      image: GO_IMAGE_REF,
-      argv: ["printf", "hello-from-go"],
-    });
-    expect(result.exitCode).toBe(0);
-    expect(result.stdout).toBe("hello-from-go");
-    await sandbox.close();
-  });
-
-  test("noop sandbox refuses golang:1.23-alpine when NOT registered", async () => {
-    // Registry not touched here — Go image is not in the allowlist.
-    // The bootstrap trio is still present, so we explicitly use a
-    // sandbox configured with only the trio.
-    const trioRefs = ["python:3.13-slim", "node:22-alpine", "alpine:3.19"];
-    const sandbox = createSandbox({ backend: "noop", allowedImages: trioRefs });
-    await expect(sandbox.exec({ image: GO_IMAGE_REF, argv: ["printf", "x"] })).rejects.toThrow(
-      /not on the allowlist/,
-    );
-    await sandbox.close();
-  });
-});
-
-describe("Go-shape T7 — cold-start budget", () => {
-  beforeEach(() => {
-    _resetSandboxImageRegistry();
-  });
-  afterEach(() => {
-    _resetSandboxImageRegistry();
-  });
-
-  test("healthcheck timeoutMs is within the compiled-language budget (≤2s)", () => {
-    const entry = registerGoSandboxImage();
-    expect(entry.healthcheck.timeoutMs).toBeLessThanOrEqual(2_000);
-    expect(entry.healthcheck.timeoutMs).toBeGreaterThan(0);
-  });
-});
-
-describe("Go-shape T8 — escape-attempt suite (reuses §18 corpus shape)", () => {
-  beforeEach(() => {
-    _resetSandboxImageRegistry();
-  });
-  afterEach(() => {
-    _resetSandboxImageRegistry();
-  });
-
-  test("Go image registration is idempotent-then-rejected (no silent override)", () => {
-    registerGoSandboxImage();
-    expect(() => registerGoSandboxImage()).toThrow(/already registered/);
-  });
-
-  test("Go entry's image string passes registry validation (no leading dash)", () => {
-    expect(GO_IMAGE_REF.startsWith("-")).toBe(false);
-  });
-
-  test("Go entry's image string contains no whitespace / newline", () => {
-    expect(/\s/.test(GO_IMAGE_REF)).toBe(false);
-    expect(GO_IMAGE_REF.includes("\n")).toBe(false);
-  });
-
-  test("Go entry's defaultEntrypoint contains no shell-meta sequences", () => {
-    for (const arg of GO_DEFAULT_ENTRYPOINT) {
-      expect(/[;&|<>$`(){}]/.test(arg)).toBe(false);
-      expect(arg.includes("\n")).toBe(false);
-    }
-  });
-
-  test("Go entry's healthcheck argv contains no shell-meta sequences", () => {
-    for (const arg of GO_HEALTHCHECK_ARGV) {
-      expect(/[;&|<>$`(){}]/.test(arg)).toBe(false);
-      expect(arg.includes("\n")).toBe(false);
-    }
-  });
-
-  test("attempted CLI-flag-injection registration via Go id is refused", () => {
-    expect(() =>
-      registerSandboxImage({
-        id: "go",
-        image: "--privileged",
-        defaultEntrypoint: ["go", "run", "-"],
-        healthcheck: { command: ["go", "version"], expectedExitCode: 0 },
-      }),
-    ).toThrow(ImageRegistrationError);
-  });
-
-  test("attempted whitespace-tampered Go image is refused", () => {
-    expect(() =>
-      registerSandboxImage({
-        id: "go",
-        image: "golang:1.23-alpine --privileged",
-        defaultEntrypoint: ["go", "run", "-"],
-        healthcheck: { command: ["go", "version"], expectedExitCode: 0 },
-      }),
-    ).toThrow(/whitespace/);
-  });
-
-  test("attempted shell-meta-tagged Go image is refused", () => {
-    expect(() =>
-      registerSandboxImage({
-        id: "go",
-        image: "golang:$(id)",
-        defaultEntrypoint: ["go", "run", "-"],
-        healthcheck: { command: ["go", "version"], expectedExitCode: 0 },
-      }),
-    ).toThrow(/valid registry/);
-  });
-});